LiveActive security incident?Get immediate response
CVE Record

CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pull() call.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This is a critical Linux kernel IPv6 bug that could affect systems processing ICMPv6 traffic. The issue is a possible use-after-free in kernel networking code. The CVE score is critical, but the provided sources do not confirm real-world exploitation.

Executive priority

Treat this as high-priority kernel patching work for internet-facing or IPv6-enabled Linux infrastructure. Do not assume compromise from this CVE alone; current provided evidence does not show active exploitation.

Technical view

The flaw is in Linux icmpv6_rcv(). It cached IPv6 source and destination address pointers before pskb_pull(), but skb->head can change afterward, creating possible use-after-free behavior. Stable kernel commits remove those temporary variables and access ipv6_hdr(skb) only when needed.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions listed in the CVE data, particularly IPv6-enabled hosts that process ICMPv6 traffic. Product-specific exposure depends on distribution kernel packaging and vendor backports.

Exploitation context

The CVE is marked CVSS 9.8 network exploitable with no privileges or user interaction. However, the bundle says KEV is false and provides no cited evidence of active exploitation or public weaponization.

Researcher notes

The root cause is pointer lifetime after skb mutation in icmpv6_rcv(). The fix is small and defensive, removing cached saddr/daddr pointers. Validate exposure through kernel branch, vendor backport status, and reachable IPv6 traffic paths.

Mitigation direction

  • Inventory Linux kernel versions across servers, appliances, containers hosts, and embedded systems.
  • Check vendor advisories for fixed kernel packages or backported patches.
  • Apply the relevant upstream stable fix or vendor kernel update when available.
  • Prioritize externally reachable IPv6-enabled systems and shared infrastructure hosts.
  • If patching is delayed, review vendor guidance for safe operational mitigations.

Validation and detection

  • Confirm each system kernel version against the CVE affected-version data and vendor advisory status.
  • Verify whether IPv6 and ICMPv6 processing are enabled on exposed interfaces.
  • Check distribution errata for whether the fix is included or backported.
  • After updating, confirm the running kernel changed, not only the installed package.
  • Monitor kernel logs and security telemetry for unusual IPv6/ICMPv6-related crashes.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-825: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-53006 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
1ADP providers
12Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux
7CVSS 3.1HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-53006Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Reported to Red Hat.

  3. ADP timelineredhat-SADP

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

redhat-SADPkernel: ipv6: fix possible UAF in icmpv6_rcv()
other:Red Hat severity ratingcvssV3_1
  • 2026-06-24T00:00:00.000Z: Reported to Red Hat.
  • 2026-06-24T00:00:00.000Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59de, 4b3418fba0fe819197e3359d5ddbef84ba2c59deunaffected
LinuxLinux4.4, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1affected
Weakness

CWE details

CWE-825

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-825 · source CWE mapping

Expired Pointer Dereference

Expired Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs